CVE-2022-44136 Zenario CMS is vulnerable to Remote Code Execution (RCE).

What is CVE-2022-44136?

CVE-2022-44136 is a critical code injection vulnerability in n/a, published on 30 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).

Which versions are affected by CVE-2022-44136?

2 open source packages ship an affected version, including tribalsystems/zenario. It affects 1 product.

Products include Tribalsystems Zenario.

How do I fix CVE-2022-44136?

Upgrade tribalsystems/zenario to 9.0.57473 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-44136 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44136 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-26830 SQL Injection in tribalsystems/zenario Critical 9.1
• CVE-2018-18420 Zenario CMS vulnerable to CSRF High 8.8
• CVE-2018-5960 SQL Injection in Zenario 7.1-7.6 High 8.8
• CVE-2021-42171 Unrestricted Upload of File with Dangerous Type in Zenario CMS High 7.2
• CVE-2022-23043 File upload restriction bypass in Zenario CMS High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4p38-rc98-cr39.